A critical command injection vulnerability in Progress Kemp LoadMaster is being actively exploited in the wild, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog on August 7, 2026. The flaw, tracked as CVE-2026-8037 with a CVSS score of 9.6, lets an unauthenticated attacker run arbitrary commands on a vulnerable LoadMaster appliance by sending specially crafted input to multiple exposed command endpoints — no login required.
The root cause is an improperly secured function called escape_quotes() within the load balancer application that fails to sanitize user-supplied input before passing it to the underlying system. Threat intelligence data shows 792 exploitation attempts from 65 unique IP addresses across 18 countries in the 41 days before CISA acted, with the most recent attempts logged on August 4, 2026. LoadMaster is Progress Software’s application delivery controller and load balancer product, widely deployed in enterprise and government environments to manage traffic across web applications and APIs — making it a high-value target for initial access. Three source IP addresses have been publicly identified as responsible for the bulk of the attack traffic, all flagged as belonging to Mullvad or NordVPN exit nodes.
How to check if you’re affected
Affected versions of Progress Kemp LoadMaster are all releases that have not yet received the patch for CVE-2026-8037. If you run LoadMaster on-premises, check your firmware version against Progress’s advisory and update immediately. U.S. federal agencies are required by Binding Operational Directive 26-04 to apply the patch by August 10, 2026. If immediate patching is not possible, restrict external access to LoadMaster management interfaces as a compensating control. Progress Software has released a fixed build — consult the Progress Trust Center (trust.progress.com) for the specific patched version number.
Sources
- The Hacker News — Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts
- CISA Known Exploited Vulnerabilities Catalog (cisa.gov/known-exploited-vulnerabilities-catalog)